2021.1 IPU – BIOS Advisory

Summary:

Potential security vulnerabilities in the BIOS firmware for some Intel® Processors may allow escalation of privilege or denial of service.** **Intel is releasing firmware updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2020-12357

Description: Improper initialization in the firmware for some Intel® Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2020-8670

Description: Race condition in the firmware for some Intel® Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2020-8700

Description: Improper input validation in the firmware for some Intel® Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2020-12359

Description: Insufficient control flow management in the firmware for some Intel® Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

CVSS Base Score: 7.1 High

CVSS Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2020-12358

Description: Out of bounds write in the firmware for some Intel® Processors may allow a privileged user to potentially enable denial of service via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

CVEID: CVE-2021-0095

Description: Improper initialization in the firmware for some Intel® Processors may allow a privileged user to potentially enable a denial of service via local access.

CVSS Base Score: 6.0 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CVEID: CVE-2020-12360

Description: Out of bounds read in the firmware for some Intel® Processors may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 5.6 Medium

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CVEID: CVE-2020-24486

Description: Improper input validation in the firmware for some Intel® Processors may allow an authenticated user to potentially enable denial of service via local access.

CVSS Base Score: 5.5 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products:

· 2nd Generation Intel® Xeon® Scalable Processors

· Intel® Xeon® Scalable Processors

· Intel® Xeon® Processor D Family

· Intel® Xeon® Processor E Family

· Intel® Xeon® Processor E7 v4 Family

· Intel® Xeon® Processor E3 v6 Family

· Intel® Xeon® Processor E3 v5 Family

· Intel® Xeon® Processor E5 v4 Family

· Intel® Xeon® Processor E5 v3 Family

· Intel® Xeon® Processor W Family

· Intel® Core™ Processors with Intel® Hybrid Technology

· 11th Generation Intel® Core™ Processors

· 10th Generation Intel® Core™ Processors

· 8th Generation Intel® Core™ Processors

· 7th Generation Intel® Core™ Processors

· 6th Generation Intel® Core™ processors

· Intel® Core™ X-series Processors

Recommendations:

Intel recommends that users of the affected products** **update to the latest firmware version provided by the system manufacturer that addresses these issues.__

Acknowledgements:

Intel would like to thank NVIDIA Product Security Team (CVE-2020-24486) and Intel employee Hareesh Khattri (CVE-2020-12357) for their reports.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.